Index: lib/Sema/SemaDecl.cpp
===================================================================
--- lib/Sema/SemaDecl.cpp
+++ lib/Sema/SemaDecl.cpp
@@ -2985,6 +2985,11 @@
     const FunctionProtoType *NewProto
       = New->getType()->getAs<FunctionProtoType>();
 
+    // The function prototype might be null, in which case
+    // there's not point to keep going and trying to merge types.
+    if (!OldProto || !NewProto)
+      return true;
+
     // Determine whether this is the GNU C extension.
     QualType MergedReturn = Context.mergeTypes(OldProto->getReturnType(),
                                                NewProto->getReturnType());
Index: test/Sema/crash-invalid-builtin.c
===================================================================
--- test/Sema/crash-invalid-builtin.c
+++ test/Sema/crash-invalid-builtin.c
@@ -0,0 +1,4 @@
+// RUN: %clang_cc1 -triple=x86_64-apple-darwin -fsyntax-only -verify %s
+// PR23086
+
+__builtin_isinf(...); // expected-warning {{type specifier missing, defaults to 'int'}} expected-error {{ISO C requires a named parameter before '...'}}